Guide · Updated · By Buğra Sözeri
What Is an Audit Trail in E-Signatures?
An audit trail is a chronological record of everything that happened to a document during signing: who it was sent to, when it was opened, and when and how it was signed.
What an audit trail records
Typical entries include when the document was created and sent, signer names and email addresses, when each signer viewed and signed, and technical details such as IP addresses.
Many services also record a fingerprint (hash) of the document so later changes can be detected. Some call the result a certificate of completion.
Why it matters
Electronic signature laws generally focus on intent to sign and on being able to attribute the signature to a person. If a signature is questioned, the audit trail is often the main evidence of who signed and when.
A signature image pasted into a PDF has no such record, which is why services with audit trails are preferred for contracts.
Audit trails in eSignSimple
When you send a document for signature with eSignSimple, the signing process is recorded in an audit trail that you can keep alongside the signed document.
What does an eSignSimple audit trail contain?
For each document: when it was created and sent, each signer's name and email, when they opened it, when they signed or declined, and their IP address and device. The certificate of completion is appended as the last page of the final PDF, and the SHA-256 document hash of that PDF is recorded so anyone can check it on the verify page. See how to verify an electronic signature for the checking steps and the security page for how files are stored.
What an audit trail cannot prove
It proves what happened to a signing link, not who was holding the device. If someone shares their email account, the trail cannot tell. That is why the email address you send to matters, and why higher-assurance methods exist for some transactions; digital vs. electronic signature explains those levels, and are electronic signatures legally binding covers how courts weigh the evidence.
Audit trail vs. certificate of completion
The audit trail is the full event log; the certificate of completion is the human-readable summary attached to the signed document. With eSignSimple they travel together in the final PDF, so you never have to hunt for a separate file. When you leave a provider, export both for every document; how to cancel a DocuSign subscription shows why that step matters.
Signing a lease is a typical case where the trail earns its keep, because several tenants sign at different times; see how to sign a lease online.
Example: reading an audit trail line by line
Here is what a typical trail for a two-person contract looks like, written out in words. Created by Dana Lee (dana@studio.example) on 3 March at 10:02. Sent to Chris Park (chris@client.example) at 10:05. Viewed by Chris Park at 14:31 from a particular IP address on a mobile browser. Signed by Chris Park at 14:36. Signed by Dana Lee at 16:10 from an office computer. Completed at 16:10, with the SHA-256 fingerprint of the final file.
Each line answers a question someone may ask later. The sent line shows which address the request went to. The gap between viewed and signed shows the signer had the document open for a few minutes rather than signing blind. The IP address and device suggest where and on what the signature happened. The completion line ties the whole sequence to one exact file. None of it depends on what the signature looks like.
Audit trail, version history or email receipts: what is the difference?
Version history in Google Docs or Word shows how a document's text changed while it was being written. It is useful for drafting and says nothing about who agreed to the final version. Email read receipts and delivery reports show that a message arrived, and are easy to turn off or fake. An e-signature audit trail is narrower and stronger: it covers the signing of one fixed file, from sending to completion, recorded by a system neither party controls.
That independence is the point. A trail kept by one of the parties in a spreadsheet is a claim; a trail generated by a third-party service as events happen, tied to a fingerprint of the file, is evidence. When you evaluate tools, ask whether the trail is created automatically, whether it travels with the document, and whether the file fingerprint can be checked by someone outside the service.
What do courts, auditors and HR teams look for in a trail?
Consistency: the email in the trail matches the one the person used in earlier correspondence, the times make sense, and the device is plausible. Completeness: every signer appears, every event from sending to completion is there, and no step is missing. Integrity: the file presented today matches the fingerprint recorded at completion, which anyone can test on the verify page.
Internal reviewers add a practical check: can they find the trail at all? A certificate stored in a separate system, under an account belonging to someone who has left, is hard to produce when an auditor asks. Keeping the certificate inside the signed PDF solves that, and so does a simple naming and storage habit for signed documents.
Where should you store signed documents and their trails?
Store the final PDF, which already contains the certificate of completion, in the same place you keep the rest of the matter or client file, not only in the signing service. Use a consistent file name such as client, document type and date. Back it up the way you back up other business records. If you leave a provider, export everything first; how to cancel a DocuSign subscription shows the steps for one common case.
Retention periods depend on the document and the country: tax, employment and property records often have legal minimums of several years. When in doubt, keep the signed file for as long as a claim could be brought under the contract. Related terms are explained in the glossary entries on the envelope and signer authentication.
Our take
An audit trail is the part of e-signing people ignore until they need it, and then it is the only part that matters. The signature itself is a squiggle anyone could copy; the trail is what shows it was your client, on that date, from that device, on that exact file. When choosing a tool, look at a sample certificate before you look at the price. If it would not convince a sceptical third party, it is not doing its job.
Sources and further reading
Frequently asked questions
Is an audit trail legally required?
Not always, but it is strong evidence that a signature is genuine and is standard practice for e-signature services.
Can an audit trail be edited?
A well-designed audit trail is generated by the system and protected from editing. Tamper detection often uses a document hash.
Do free PDF signing tools create an audit trail?
Usually not. Signing your own PDF adds a signature image only. Sending for signature through a service creates the audit trail.
How long should I keep audit trails?
As long as you keep the contract itself, and at least as long as any claim under it could be brought. The simplest rule is to store the certificate inside the signed PDF, which eSignSimple does automatically.
Can signers see the audit trail?
With eSignSimple, yes. Every party receives the final PDF, and the certificate of completion summarising the trail is its last page.
Does recording IP addresses raise privacy issues?
IP addresses are personal data in some jurisdictions, including the EU. E-signature services generally record them to evidence a contract both parties chose to sign, and should explain this in their privacy policy.
Is an audit trail the same as a log file?
It is a kind of log, but a focused one: it records only the events of one document's signing, in a readable form, and is tied to the final file by its fingerprint.
Get your next document signed today.
Start with 3 free documents a month. No card needed.